The vulnerability is a missing authorization flaw in the WordPress User Registration plugin that allows attackers to exploit incorrectly configured access control security levels. This broken access control can enable unauthorized users to perform actions that should be restricted, potentially leading to the creation, modification, or deletion of user accounts and sensitive data. The weakness is identified as CWE‑862, highlighting a failure to enforce proper permissions.

The issue affects the WordPress User Registration plugin sold by wpeverest, specifically all versions up to and including 4.4.6. Sites running any of these versions are at risk, while newer releases are presumed to have a fix.

With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s public-facing registration interface, where an attacker may submit crafted requests to perform unauthorized actions. Mitigation requires removing or patching the vulnerable code.